PT-2025-51640 · Linux+3 · Linux Kernel+3
Published
2025-12-16
·
Updated
2026-05-07
·
CVE-2025-68227
CVSS v2.0
4.6
Medium
| Vector | AV:L/AC:L/Au:S/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
A flaw exists in the Linux kernel’s MPTCP implementation related to protocol fallback detection with BPF. The issue arises when a server has MPTCP enabled, but a client sends a TCP SYN without MPTCP, leading to an incorrect comparison of socket protocols during subflow handling. Specifically, the
sk prot is used for comparison instead of the more generic sk family, potentially leading to incorrect socket operations. This can occur during the mptcp stream accept function, triggered by a BPF sockops call. The fix involves using sk family for the comparison. This also resolves a WARNING message observed in the kernel logs during the mptcp stream accept function. The vulnerable code path involves the following functions: tcp rcv state process(), syn recv sock(), subflow syn recv sock(), tcp init transfer(), bpf skops established(), bpf sock map update(), tcp bpf update proto(), subflow ulp fallback(), subflow drop ctx(), and mptcp subflow ops undo override().Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Debian
Linuxmint
Linux Kernel
Ubuntu